Commit Graph

96 Commits

Author SHA1 Message Date
Dr. Stefan Schimanski
acbb89d9b9 kube-apiserver: split admission initializers into generic and non-generic
Signed-off-by: Dr. Stefan Schimanski <stefan.schimanski@gmail.com>
2024-04-29 23:28:42 +02:00
cici37
de506ce7ac Promote ValidatingAdmissionPolicy to GA. 2024-03-05 16:00:21 -08:00
Jiahui Feng
6b03166bed update to inject only the list of excluded resources. 2024-03-05 11:11:10 -08:00
Jiahui Feng
b115df227a update tests due to change of NewPluginInitializer. 2024-02-28 15:56:14 -08:00
Jiahui Feng
5b1fffa3e4 add resource filter to admission initializer. 2024-02-28 15:31:18 -08:00
Jiahui Feng
049614f884 ValidatingAdmissionPolicy controller for Type Checking (#117377)
* [API REVIEW] ValidatingAdmissionPolicyStatucController config.

worker count.

* ValidatingAdmissionPolicyStatus controller.

* remove CEL typechecking from API server.

* fix initializer tests.

* remove type checking integration tests

from API server integration tests.

* validatingadmissionpolicy-status options.

* grant access to VAP controller.

* add defaulting unit test.

* generated: ./hack/update-codegen.sh

* add OWNERS for VAP status controller.

* type checking test case.
2023-07-13 13:41:50 -07:00
charles-chenzz
ccf7ddacfc replace ioutil with os, update doc 2023-04-13 09:02:46 +08:00
Jiahui Feng
501976cc34 fix broken tests after dependency injection. 2023-03-13 14:40:47 -07:00
Jiahui Feng
feb18b3f5f implmementing type checking
with multi-type support.
2023-03-07 15:49:19 -08:00
TommyStarK
bd6a86471b kubeapiserver/admission: Improving test coverage
Signed-off-by: TommyStarK <thomasmilox@gmail.com>
2022-12-15 19:01:52 +01:00
Cici Huang
c8a089de46 Update admission initializers.
Moved RestMapper and add DynamicClient
2022-11-07 21:24:46 +00:00
Sally O'Malley
47e7d8034f kubelet tracing
Signed-off-by: Sally O'Malley <somalley@redhat.com>
Co-authored-by: David Ashpole <dashpole@google.com>
2022-08-01 12:55:02 -04:00
David Ashpole
9dd59017c4 add tracing to webhook requests 2021-07-09 06:30:05 -07:00
Benjamin Elder
56e092e382 hack/update-bazel.sh 2021-02-28 15:17:29 -08:00
Tim Usner
70d440bc7e Move ResourceQuota admission to k8s.io/apiserver 2020-09-04 14:53:52 +02:00
Davanum Srinivas
07d88617e5 Run hack/update-vendor.sh
Signed-off-by: Davanum Srinivas <davanum@gmail.com>
2020-05-16 07:54:33 -04:00
Davanum Srinivas
442a69c3bd switch over k/k to use klog v2
Signed-off-by: Davanum Srinivas <davanum@gmail.com>
2020-05-16 07:54:27 -04:00
Jefftree
1289bdaba4 network proxy with admission wh 2020-01-08 15:01:38 -08:00
hwdef
b3377e61de pkg/kubeapiserver: fix staticcheck warning 2019-11-14 11:24:22 +08:00
Jordan Liggitt
61774cd717 Plumb context to admission Admit/Validate 2019-08-20 11:11:00 -04:00
Daniel (Shijun) Qian
5268f69405 fix duplicated imports of k8s code (#77484)
* fix duplicated imports of api/core/v1

* fix duplicated imports of client-go/kubernetes

* fix duplicated imports of rest code

* change import name to more reasonable
2019-05-08 10:12:47 -07:00
yue9944882
65ba58a9a5 remove internal client dependency in pkg/* 2019-04-09 21:43:51 +08:00
Kubernetes Prow Robot
0ffd59e403 Merge pull request #74154 from mbohlool/gimli
Use Request Object interfaces instead of static scheme that is more appropriate for CRDs
2019-02-19 07:21:53 -08:00
Mehdy Bohlool
513a87c7b2 Add ObjectInterfaces to Admission and Validation 2019-02-16 13:28:47 -08:00
Chao Xu
1f2e2e61cf generated 2019-02-12 15:04:57 -08:00
Chao Xu
3f21ca029a changing imports 2019-02-12 10:06:04 -08:00
Jordan Liggitt
1a15d80967 generated 2019-01-23 16:34:44 -05:00
Jordan Liggitt
17aa60686e Deprecate and remove use of alpha metadata.initializers field, remove IncludeUninitialized options 2019-01-23 16:34:43 -05:00
Davanum Srinivas
954996e231 Move from glog to klog
- Move from the old github.com/golang/glog to k8s.io/klog
- klog as explicit InitFlags() so we add them as necessary
- we update the other repositories that we vendor that made a similar
change from glog to klog
  * github.com/kubernetes/repo-infra
  * k8s.io/gengo/
  * k8s.io/kube-openapi/
  * github.com/google/cadvisor
- Entirely remove all references to glog
- Fix some tests by explicit InitFlags in their init() methods

Change-Id: I92db545ff36fcec83afe98f550c9e630098b3135
2018-11-10 07:50:31 -05:00
walter
2af982abb9 Fixes lint errors in kubeapiserver packages
Fixes lint errors in kubeapiserver/admission, kubeapiserver/authorizer,
kubeapiserver/authenticator. Also enables lint testing of these
directories.
Fixed go format.
Fixed changes from config.
2018-11-04 17:22:41 -08:00
Patrick Barker
d33f347ba8 refactors kubeapiserver webhook utility to be generic generated 2018-11-02 11:42:04 -06:00
Patrick Barker
1081fffdd5 refactors kubeapiserver webhook utility to be generic 2018-11-02 11:41:58 -06:00
zuoxiu.jm
efeec1edee remove internal informer/lister generator 2018-10-29 11:37:55 +08:00
zuoxiu.jm
7f608eb5df prune internal informer from kubeapiserver constructor 2018-10-29 11:30:44 +08:00
yue9944882
6a8faa6e40 replace contrustor of ad controller with config.complete.new flow
review:
1. import order
2. only set nil field on complete
3. replace hardcoded default namespace
2018-10-26 11:49:37 +08:00
Kim Min
79599ac419 Prune internal clientset/informer from kubeapiserver admission initializer (#70167)
* externalize pv resize admission controller

* externalize podtolerationrestriction admission controller

* externalize podnodeselector admission controller

* remove internal clientset/informer from kubeapiserver admission initializer

* minor change: fixes scheduler integration test compiliation
2018-10-24 14:47:16 -07:00
k8s-ci-robot
0805860dba Merge pull request #67870 from yue9944882/refactor/externalize-resource-quota-admission-controller
Externalize resource quota admission controller & controller reconciliation
2018-09-25 02:41:40 -07:00
Mehdy Bohlool
1d8340bde5 update generated files 2018-08-31 16:07:15 +10:00
Mehdy Bohlool
5652d5cffa Refactor addmission webhook hook client to a util package 2018-08-31 16:07:15 +10:00
yue9944882
ede89afa99 align imports for kubeapiserver admission initializer 2018-08-27 21:52:08 +08:00
yue9944882
bc1fb1f7e8 node authz/ad externalization 2018-08-09 10:57:30 +08:00
Jeff Grafton
23ceebac22 Run hack/update-bazel.sh 2018-06-22 16:22:57 -07:00
Jeff Grafton
ef56a8d6bb Autogenerated: hack/update-bazel.sh 2018-02-16 13:43:01 -08:00
Jeff Grafton
efee0704c6 Autogenerate BUILD files 2017-12-23 13:12:11 -08:00
Dr. Stefan Schimanski
e19257f2ec admission/webhook: move webhook initializer into plugin 2017-11-20 09:28:42 +01:00
Chao Xu
1adfacc7eb Reorganize the admission webhook code.
Moved client and kubeconfig related code to webhook/config;
Moved the rule matcher to webhook/rules;
Left TODOs saying we are going to move some other common utilities;
Other code is moved to webhook/validation.
2017-11-14 15:59:53 -08:00
Dr. Stefan Schimanski
aedcf681b3 admission: rename Validate{ -> Initialization}, Validat{ingAdmit -> e} 2017-11-02 09:29:55 +01:00
Kubernetes Submit Queue
27ef37a32d Merge pull request #54320 from derekwaynecarr/quota-update
Automatic merge from submit-queue (batch tested with PRs 54331, 54655, 54320, 54639, 54288). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Ability to do object count quota for all namespaced resources

**What this PR does / why we need it**:
- Defines syntax for generic object count quota `count/<resource>.<group>`
- Migrates existing objects to support new syntax with old syntax
- Adds support to quota all standard namespace resources 
- Updates the controller to do discovery and replenishment on those resources
- Updates unit tests
- Tweaks admission configuration around quota
- Add e2e test for replicasets (demonstrate dynamic generic counting)

```
$  kubectl create quota test --hard=count/deployments.extensions=2,count/replicasets.extensions=4,count/pods=3,count/secrets=4
resourcequota "test" created
$ kubectl run nginx --image=nginx --replicas=2
$ kubectl describe quota
Name:                         test
Namespace:                    default
Resource                      Used  Hard
--------                      ----  ----
count/deployments.extensions  1     2
count/pods                    2     3
count/replicasets.extensions  1     4
count/secrets                 1     4
```

**Special notes for your reviewer**:
- simple object count quotas no longer require writing code
- deferring support for custom resources pending investigation about how to share caches with garbage collector.  in addition, i would like to see how this integrates with downstream quota usage in openshift.

**Release note**:
```release-note
Object count quotas supported on all standard resources using `count/<resource>.<group>` syntax
```
2017-10-27 15:42:24 -07:00
Chao Xu
ca8131877a remove the nesting directory webhook/webhook 2017-10-27 10:09:46 -07:00
Derek Carr
5b4ca14307 Update admission control framework for quota 2017-10-27 11:08:14 -04:00